NASA Technical Memorandum 102661 

Failure of the ERBE Scanner Instrument Aboard 
NOAA 10 Spacecraft and Results of Failure Analysis 


J. B. Miller 
W. L. Weaver 

L. P. Kopia 

C. E. Howerton 

M. G. Payton 
C. J. Harris 


May 1990 


( *'a c A- T M - 1026S1 ) r-AILURt cF THE FR ; £ 

>C ANNF R INSTRUMENT AoDARU NOAA 10 SPACECRAFT 

ano results g c failure analysis (nasa) 

> 7 CSCL 14" 

‘ £3/3^ 


N j2c 

Unci as 
02921 7o 


NASA 

National Aeronautics and 
Space Administration 


Langley Research Center 

Hampton, Virginia 23665-5225 



Table of Contents 


Executive Summary 1 

Background 2 

Overview of Instrument Operational Design Features ... 2 

In-Flight Operations 2 

Previous Instrument Anomalies 5 

Description of Malfunction and Troubleshooting Approach ... 6 

Malfunction, Preliminary Testing and Analysis 6 

Command Tests and Instrument Responses 8 

Failure Analysis 14 

Observations and Analysis 14 

Reset Command 14 

Spacecraft DIG A Data Transfer 14 

Azimuth Commands 16 

Scan Commands 16 

SWICS Commands and Internal Calibration Sequence 

Command 17 

Program Memory Considerations 18 

SWICS Internal Calibration Implementation 20 

First Failure Hypothesis 20 

First Hypothesis Testing 20 

Revised Failure Hypothesis 21 

Revised Hypothesis Testing 21 

Conclusions and Recommendations 23 

Acknowledgments 24 

References 24 


i 




Executive Summary 


The Earth Radiation Budget Experiment (ERBE) scanner instrument 
aboard the NOAA-IO spacecraft was launched into orbit in 
September 1986 and began making routine Earth radiation 
measurements in November 1986. On May 22, 1989, the instrument 
was operating in the normal Earth scan mode and at the normal 
cross— track azimuth position of 0 degrees. At 17:03 UT, in the 
middle of a 4-second scan cycle, all values in the instrument 
primary data output (DIG A) went to zero. The DIG B data 
indicated that the elevation beam motor power had remained on, 
and the analog data showed increases in several temperatures at 
the time of the malfunction. 

Since the malfunction, all of the instrument operational modes 
and data storage commands have been exercised, along with some 
typical pulse discrete commands to instrument heaters . The tests 
were unsuccessful in restoring the instrument to normal 
operation, but have provided the data needed to analyze the 
malfunction. In the final test performed, the instrument was 
powered off and powered back on about 3 hours later. The 
instrument was powered off in an attempt to bleed off excess 
charge which might have been deposited in a gate by a radiation 
event. This report discusses command testing, the instrument 
responses during the tests, and describes the analysis, together 
with results and conclusions, which was performed to determine 
the cause of the malfunction. 

The data output from the instrument, both housekeeping and 
radiometric, appear to be valid, and the instrument responses to 
several of the operational mode commands are completely normal . 
However, the instrument fails to correctly execute either the 
automated (preprogrammed) internal or solar calibration 
sequences. And, unfortunately, the instrument will not perform 
correctly in any operational scan mode. When the instrument is 
commanded to operate in any of the operational scan modes, it 
stops scanning after scan beam initialization, and all values in 
the DIG A data revert to zero. Sending a CPU Reset command at 
any time restores the DIG A data to normal values. 

The increase in housekeeping temperatures at the time of the 
malfunction and the subsequent decreases following first CPU 
Reset command were nearly identical to those seen after the 
failure of the NOAA-9 scanner instrument. This appears to be the 
extent of the similarity between the two failures. The NOAA-9 
scanner instrument DIG A data were not restored to valid values 
by the CPU Reset command and the instrument never responded to 
any mode commands . 

The problem with the NOAA-IO scanner instrument was traced to a 
failure in the internal address decoding circuitry in one of the 
ROM (Read Only Memory) chips in the instrument. Unfortunately, 


1 



there is no method of reprogramming the processor. It is 
recommended that the CERES instruments and other instruments with 
extended mission requirements, which rely on computers for their 
operation, be designed with the capability to be reprogrammed by 
ground commands . 


Background 

Overview of Instrument Operational Design Features 

The scanner instrument was designed to perform a wide range of 
operations. An overview of the instrument operational design 
features is given here, and further details can be found in 
reference 1. The azimuth beam can rotate between 0 and 180 
degrees in the local horizon plane, and the rotation plane of the 
elevation (scan) beam is normal to the azimuth plane. Each 
instrument has its own computer which is used to direct and 
control instrument operations. Commands can be issued directly 
from the ground or from command tables uplinked and stored in the 
spacecraft computer memory. Table 1 is a list of the instrument 
operational commands. A mode command directs the instrument to 
perform a specific function or to change its operational mode. 
Data storage commands store azimuth angle data required in some 
of the azimuth-rotation commands. The automated calibration 
sequence commands (8A1 and 8A2 in table 1) direct the instrument 
to perform the sequence of mode commands listed in table 2 in the 
order and at the relative times shown. No other mode commands 
can be executed while an automated calibration sequence is in 
progress. The solar calibration sequences are slightly different 
for the instruments on the ERBS and NOAA spacecraft and the 
sequence for the instruments on the NOAA spacecraft, only, is 
shown in table 2b. 


In-Flight Operations 

The scanner instrument on NOAA-10 is one of three which have been 
launched into Earth orbit as part of the Earth Radiation Budget 
Experiment. Each ERBE scanner instrument is paired on a 
different spacecraft with a nonscanner (fixed field of view) 
instrument. The first instruments were launched into orbit on 
the ERBS spacecraft by the Space Shuttle Challenger on October 5, 
1984. ERBS is operated by NASA from the Goddard Spaceflight 
Center in Greenbelt, Maryland. The spacecraft is in a 600-km 
altitude orbit with right ascension of the ascending node 
precessing westward at about 4 degrees per day. The other 
instruments were launched into orbit aboard the NOAA-9 and 
NOAA-10 TIROS-N weather satellites in December 1984 and September 
1986, respectively. The NOAA spacecraft are operated by NOAA 
from Suit land, Maryland. Both spacecraft are in nearly 
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Table 1 

Scanner Instrument Operations Commands 


Operational Mode Commands 
Command Description 


Hexadecimal 
Cmd Code 


Azimuth to 0 deg position 
Azimuth to 90 deg position 
Azimuth to 180 deg position 
Azimuth to position A 
Azimuth to position B 
Azimuth scan between 0 and A 


811 
812 
813 
81 4 

815 

816 


Scan to stow position 
Normal Earth Scan 
Nadir Earth Scan 
Short Earth Scan 
Mam Scan 


821 

822 

823 

824 

825 


SWICS off 

SWICS at level 3 892 
SWICS at level 3 - modulated 893 
SWICS at level 2 894 
SWICS at level 2 - modulated 895 
SWICS at level 1 896 
SWICS at level 1 - modulated 897 


Internal calibration sequence 
Solar calibration sequence 


8A1 

8A2 


Azimuth Angle Data Storage Commands 


Command Description 


Hexadecimal 
Cmd Code 


Address for azimuth position A 
Address for azimuth position B 
Data, Most significant byte 
Data, Least significant byte 


419 
41 B 
2xx 
Ixx 


Note: xx indicates actual azimuth position data. 
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Table 2 

Scanner Instrument Automated Calibration Sequences 


(a) - Internal Calibration Sequence 


Step 

Elapsed Time 

Hex 

Event Description 

No. 

Hr : Min: Sec 

Command 





1 

00:00:00 

8A1 

Begin 

Internal 

Cal 




Sequence 



2 

00:00:32 

897 

SWICS 

Level 

#1 

Modulated 

3 

00:02:08 

895 

SWICS 

Level 

#2 

Modulated 

4 

00:03:44 

893 

SWICS 

Level 

#3 

Modulated 

5 

00:05:20 

891 

SWICS 

Off 




00:08:00 


*See note 1 



6 

00:08:32 

897 

SWICS 

Level 

#1 

Modulated 

7 

00:10:08 

895 

SWICS 

Level 

#2 

Modulated 

8 

00:11 : 44 

893 

SWICS 

Level 

#3 

Modulated 

9 

00:13:20 

891 

SWICS 

Off 




00:32:00 


*See note 2 



10 

00:32:32 

897 

SWICS 

Level 

#1 

Modulated 

1 1 

00:34:08 

895 

SWICS 

Level 

i n 

Modulated 

12 

00:35:44 

893 

SWICS 

Level 

§3 

Modulated 

13 

00:37:20 

891 

SWICS 

Off 




Note 1 - Black Body Heaters Turned On By Pulse Discrete 
Command 

Note 2 - Black Body Heaters Turned Off By Pulse 
Discrete Command 


(b) - Solar Calibration Sequence For NOAA Spacecraft 


Step Elapsed Time Hex Event Description 

No. Hr: Min: Sec Command 


1 

00:00 

00 

8A2 

2 

00:00 

32 

824 

3 

00:01 

04 

811 

4 

00:01 

36 

814 

5 

00:06 

24 

825 

6 

00:11 

44 

815 

7 

00:18 

08 

814 

8 

00:23 

28 

824 

9 

00:24 

00 

81 1 

10 

00:28 

48 

822 


Begin Solar Cal Sequence 
Short Earth Scan 
Azimuth to 0 degrees 
Azimuth to Position A 
MAM scan 

Azimuth to Position B 
Azimuth to Position A 
Short Earth Scan 
Azimuth to 0 degrees 
Normal Earth Scan 
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Sun-synchronous orbits (825 to 875 km altitude) , each with a 
different mean local time for its orbit node crossing. The ERBS 
orbit produces a more severe and more variable thermal 
environment at the spacecraft than the orbits of NOAA-9 and 
NOAA-IO, but the higher altitude orbits of the NOAA spacecraft 
produce more severe space radiation environments. 

All the scanner instruments have been operated primarily in the 
normal Earth scan mode and at an azimuth position of either 0 or 
180 degrees to provide continuous measurements in a cross-track 
scan plane. The instruments on ERBS and NOAA-IO have been 
operated at other azimuth angles during periods of low Sun beta 
angle (angle between Sun and orbit momentum vectors) to prevent 
the detectors from scanning the Sun. For brief periods of time, 
the instruments on ERBS and NOAA-9 have been operated at an 
azimuth position of 90 degrees to obtain measurements in the 
along- track scan plane. Internal calibrations of all the scanner 
instruments have been performed about every two weeks. Solar 
calibrations have been less regular because of instrument azimuth 
beam rotation and scanner elevation beam anomalies, problems 
which are discussed in the next section. Only one solar 
calibration was ever performed with the scanner instrument on 
NOAA-1 0 . 


Previous Instrument Anomalies 

All three scanner instruments have experienced the scan beam 
anomaly problem. The problem is usually characterized by 
sluggishness when the scan beam is in one of the boost 
(high— acceleration ) portions of a 4-second scan cycle, and the 
sluggishness is sometimes accompanied by a rise in some of the 
scan drive electronics temperatures. The problem was observed 
with each of the instruments about 3 months after launch into 
orbit. The problem has been severe at times, causing the scan 
beam to hang up or stop during a scan. The investigation 
reported in reference 2, which covered the scan beam anomaly on 
ERBS and NOAA-9, concluded that the most probable cause of the 
scan beam anomaly was a problem in the scanner beam bearing 
lubrication system. The investigators found a high probability 
that the rise in temperature, which accompanies the anomaly, is 
due to the instrument operating continuously in the high power 
mode which is normally only associated with the boost mode 
(high-acceleration) portion of the scan cycle. The investigators 
correctly predicted that the problem would also occur with the 
scanner instrument on the NOAA-IO spacecraft. No evidence was 
found that the scan beam anomaly was related to the instrument 
computer . 

An azimuth beam rotation anomaly has occurred from time to time 
on all three scanner and nonscanner instruments. In the azimuth 
beam rotation anomaly, the azimuth position sensor apparently 
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reads erroneous position data when commanded to change azimuth 
modes, causing the azimuth beam to rotate incorrectly and usually 
to end up at the wrong azimuth position. The problem was first 
observed with the instrument on the ERBS spacecraft on February 
20, 1985 when the azimuth beam did not return to its normal 
position of 180 degrees after a routine solar calibration. The 
problem resulted in the detectors directly scanning the Sun, 
causing a change in the spectral response of one of the 
detectors. On the NOAA-10 spacecraft in November 1986, the 
anomaly was observed during the first attempt to perform a solar 
calibration of the scanner instrument. The anomaly resulted in 
the decision to discontinue solar calibrations of the instrument. 
The anomaly was studied in 1985 and 1986, and it was concluded 
that the anomaly was caused by the Sun interfering with the 
azimuth position sensor during beam rotation. Stray Sun light 
probably illuminates the azimuth position sensor photo detector 
causing erroneous position data. The instrument computer does 
not appear to be responsible for the azimuth rotation anomaly. 

The scanner instrument on the NOAA-9 spacecraft failed on January 
20, 1987, and all attempts to restore the primary (DIG A) data 
output have been unsuccessful. Similarities between the scanner 
failure on NOAA-9 and the scanner malfunction on NOAA-10 are 
discussed in the next section. 


Description of Malfunction and Troubleshooting Approach 

Malfunction, Preliminary Testing and Analysis 

At 17:03 Universal Time on May 22, all values in the primary 
output data (DIG A) of the scanner instrument on NOAA-10 went to 
zero. The bilevel data (DIG B) and several instrument 
temperatures and voltages (analog), which are output on a 
different data buses than that of the DIG A data, remained valid. 
The DIG B data indicated that the scanner elevation motor power 
remained on after the malfunction, and figure 1(a) shows how two 
of the instrument analog temperatures began to increase at the 
time of the malfunction. 

The first CPU Reset command was executed on May 23. The CPU 
Reset causes a hardware reset of the instrument computer. This 
clears the computer registers, restarts the stored program, and 
resets some scanner hardware. The scanner elevation motor power 
was turned off by the CPU Reset, and figure 1(b) shows that the 
analog temperatures began to decrease at that time. The CPU 
Reset command also restored the primary (DIG A) data to valid 
values. After the instrument was sent a normal Earth scan 
command ( see table 1 ) , the scan beam apparently executed a normal 
16-second initialization sequence. This conclusion is based on 
the output of the elevation beam position sensor and the 
radiometric detectors. At the end of the initialization 
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NOAA-IO SCANNER MAY 22. 1989 
POWER CONVERTER TEMP (STA3) Sc SUCE 3 TEMP (STA4) 



STA3 
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Malfunction 
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Univ*r**) Time, hour* 


(a) - Day of malfunction 





NOAA-IO SCANNER MAY 23. 1989 
POWER CONVERTER TEMP (STA3) Sc SUCE 3 TEMP (STA4) 


i* o n _ 

r“ n r " i ' • r“LJ i 

f\ 

CPU reset \ 



8 10 11 12 13 14 18 18 17 18 18 20 21 22 23 24 


Univtntl Tim*, hour* 


(b) - Day after malfunction 


Instrument Temperatures Following Malfunction 

Figure 1 
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sequence, the elevation motor power was apparently turned off 
automatically, and the DIG A data again reverted to zero values. 
Elevation position data, transmitted following a subsequent CPU 
Reset, indicates that the scanner elevation beam appeared to have 
achieved position lock at the normal Earth scan space-look 
position. Several times on May 23 and 24, the instrument was 
sent CPU Reset commands, followed by normal Earth scan mode 
commands. In every case, the instrument response was identical 
to the response received the first time these commands were sent 
on May 23. On May 26, a CPU Reset command, only, was sent to the 
instrument, and no other commands were sent until May 31 . The 
DIG A data remained valid, and instrument housekeeping and 
radiometric data showed typical responses to the in-orbit heating 
environment during this five-day period. 

Before the malfunction on May 22, the instrument was operating in 
the normal Earth scan mode and at the cross- track azimuth 
position of 0 degrees . The instrument had been operating 
continuously in the normal Earth scan mode since December 5, 

1986. The azimuth beam had been rotated to the cross-track 
position of 0 degrees on April 16, 1989, a few days after the 
spacecraft had exited a full-Sun orbit condition. An automated 
internal calibration had been performed on May 10, 1989. Thus, 
the last command which had been executed by the instrument was a 
SWICS off command (see table 2a). Instrument data for May 21 and 
for the period before the malfunction on May 22 indicate no 
unusual behavior of the instrument. The scan beam was a little 
sluggish, but the sluggishness was much less severe than that 
observed during some earlier periods, particularly from January 
to March 1987. 

The DIG B data and analog temperatures of the scanner instrument 
on the NOAA-9 spacecraft showed nearly identical responses at the 
time of the failure on January 20, 1987, and at the time of the 
first CPU Reset command. However, there were no other 
similarities observed between the malfunction of the scanner 
instrument on the NOAA-10 spacecraft and the failure of the 
scanner instrument on the NOAA-9 spacecraft. The DIG A data of 
the instrument on NOAA-9 was never restored to valid values, and 
the instrument has never responded to any commands after the 
initial CPU Reset command. 


Command Tests and Instrument Responses 

All the instrument operational mode and data storage commands 
were tested during the period from June 5 to September 15, 1989, 
and two heaters were turned off and on via pulse discrete 
commands (see table 3). Most of the commands were sent during 
communication linkups between the spacecraft and the operations 
control center at NOAA/NESDIS in Suitland, Maryland, and Langley 
personnel were at NOAA during some of the command testing. This 
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Table 3 

Instrument Command Tests and Responses 


On/Off Commands To Heaters 


Command 

PEDESTAL HEATER ON 
PEDESTAL HEATER OFF 
BLACK BODY HEATERS ON 
BLACK BODY HEATERS OFF 


Date Instrument Response 

Jun 1 Bi-level data showed heater ON 

Jun 1 Bi-level data showed heater OFF 

jun 1 Bi-level data showed heaters ON 

Jun 1 Bi-level data showed heaters OFF 

Black body temperatures responded 
normally . 


AZIMUTH ANGLE A 


SWICS MODULATED - 


LEVEL #1 

Jun 

19 

LEVEL #2 

Jun 

2 

LEVEL #3 

Jun 

19 

SWICS UNMODULATED - 
LEVEL #1 

Sep 

5 

LEVEL §2 

Sep 

5 

LEVEL #3 

Sep 

5 

ROTATE AZ TO 0 DEG 

Jun 

6 

ROTATE AZ TO 90 DEG 

Sep 

6 

ROTATE AZ TO 180 DEG 

Sep 

6 

ROTATE AZ TO ANGLE A 

Jun 

6 

(20 DEGREES) 

ROTATE AZ TO ANGLE B 

Sep 

6 

(45 DEGREES) 

ROTATE CONTINUOUSLY 

Sep 

6 

BETWEEN 0 AND 35 DEG 

Sep 

6 

NORMAL EARTH SCAN 

May 

23 

SHORT EARTH SCAN 

Jun 

6 

NADIR EARTH SCAN 

Jun 

7 

SOLAR MAM SCAN 

Jun 

7 

SCAN TO STOW 

Jun 

7 

AUTOMATED INT CAL SEQ 

! Jul 

5 


Data Storage Commands 

Jun 5 Instrument processed address and 

data commands normally for 
20-degree azimuth value. 

Operational Mode Commands 

Jun 19 SWICS amplifier output normal 

Jun 2 SWICS amplifier output normal 

Jun 19 SWICS amplifier output normal 

Sep 5 SWICS amplifier output normal 

Sep 5 SWICS amplifier output normal 

Sep 5 SWICS amplifier output normal 

Jun 6 Azimuth beam rotation normal 

Sep 6 Azimuth beam rotation normal 

Sep 6 Azimuth beam rotation normal 

Jun 6 Azimuth beam rotation normal 

Sep 6 Azimuth beam rotation normal 

Sep 6 Azimuth beam rotation normal 

Sep 6 Azimuth beam rotation appeared to 

. be normal . 

May 23 Scan beam initialize, scanner 
Jun 6 motor power turned off, DIG A 

Jun 7 data reverted to zeros (all 

Jun 7 scan mode commands ) . 


Incorrect Sequence . Mod SWICS 
level #3 command turned on and off 
several times. (Table 4a) 


Incorrect Sequence (Table 4b) . 


AUTOMATED SOL CAL SEQ 


Sep 15 


arrangement permitted the instrument behavior and responses to 
the commands to be monitored directly, and for go/no-go decisions 
on testing to be made in real time. Table 3 lists each of the 
commands sent, by category, the date on which the command was 
exercised, and comments on the instrument response to the 
command. Some of the commands were exercised more than one time, 
and the execution date listed for a command is the first date of 
execution for which all the DIG A data were available in the data 
stream. The two-month lapse between the internal calibration 
sequence test on July 5 and the next commands issued on September 
6, was used to analyze the data output from the execution of the 
internal calibration sequence. The responses to the commands are 
discussed in this section, and a detailed analysis of the output 
data is presented in the next section. 

The responses of the two heaters which were tested on June 1 were 
completely normal and are believed to be representative of 
responses for all heaters. Therefore, no further heater testing 
was performed. 

The instrument responded normally to all azimuth mode commands. 
The command to rotate continuously between angle 0 degrees and 
angle A (35 degrees in this case) had not been previously tested 
in flight. The azimuth angle data for 20 degrees which was 
processed by the data storage commands on June 5 were used in the 
successful azimuth beam rotation to 20 degrees on June 6. 

Only the modulated SWICS commands, which are executed during the 
internal calibration sequences, had been previously executed in 
orbit, and none of the 6 SWICS commands had been tested 
individually in orbit. The responses to all the SWICS commands, 
however, are believed to be completely normal. The magnitudes of 
the SWICS amplifier outputs at all levels were identical to the 
levels typically observed during internal calibrations. 

The responses to all the scan mode commands were identical to the 
responses to the normal Earth scan commands executed on May 23 
and 24. In each case, the scanner ■ elevation beam appeared to go 
through a 16-second initialization sequence and to be positioned 
at the space look angle of 1 4 degrees at the end of the sequence . 
The elevation motor power was then turned off automatically, and 
the values of the DIG A data reverted to zeros. 

The automated internal calibration sequence command (Hex command 
code 8A1 ) stored in the NOAA-10 spacecraft computer command table 
is issued routinely every two weeks. However, July 5 was the 
first calibration date after the malfunction for which the output 
of the complete calibration sequence was available in the DIG A 
data stream. The DIG A data were invalid when the first sequence 
was issued on May 24 (no CPU Reset command was in effect), and 
the command sequences on June 10 and June 26 were interrupted by 
CPU Reset commands which were issued prior to completion of the 
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sequences. The CPU Reset commands were issued from the ground 
when it appeared that the internal calibration sequence had 
terminated abnormally. The instrument responses have been 
identical for all internal calibration sequence commands issued 
since July 5. Table 4a compares the instrument responses during 
a typical calibration before and after the malfunction. Figure 2 
shows typical SWICS amplifier output for normal and abnormal 
sequences. A total of 13 mode commands (including the internal 
calibration sequence command) are issued during both normal and 
abnormal command sequences, but the commands and the relative 
times at which they are executed are incorrect for the abnormal 
sequence. The level #3 modulated SWICS command is seen to be 
turned on and off 6 different times during the nearly 10-hour 
execution period of the abnormal command sequence . 

Table 4b compares the execution of the first five commands in the 
automated solar calibration sequence for a normal execution and 
the abnormal execution on September 1 5 . The command echo word 
showed an invalid command code (804) at the time when a short 
Earth scan mode command (824) should have been executed. The 
third command (rotate in azimuth to angle A) was correct in the 
abnormal sequence, but it was executed more than 2 hours late, 
and the invalid command code, 804, appeared again in the command 
echo a little over 2 hours after the valid command. A MAM scan 
command was executed about three and one half hours after the . 
beginning of the sequence. The instrument response was identical 
to that during the execution of all scan mode commands since the 
malfunction. After the DIG A values went to zero, a CPU Reset 
command was sent, restoring the DIG A data. 

The final test of the instrument was performed on October 17 when 
the instrument was powered down, and after about 3 hours, powered 
back up. During the three hour period when instrument power was 
off, several housekeeping temperatures dropped below their normal 
operating values. After power— up, a normal Earth scan command 
was executed, and the instrument response was again the same as 
for all previous scan mode commands. A CPU Reset command was 
then executed, which restored the DIG A data to valid values. 
Housekeeping temperatures returned to their normal operational 
range within a few hours. The instrument will be left in the 
power-on state, and the instrument output will be monitored. 

There are no plans to perform further testing of the instrument. 
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Table 4 

Comparison of Calibration Sequences Execution 
Before and After the Malfunction 

(a) - Internal Calibration Sequence 
Before Malfunction (Normal) After Malfunction 

Step Elapsed Event Description Elapsed Event Description 


No. 

Time 






Time 






(H:M:S) 






(H:M:S) 





1 

00:00:00 

Int Cal Seq Cmd 

(8A1 ) 

00:00:00 

Int Cal Seq Cmd 

2 

00:00:32 

SWICS 

Lev 


Mod 

(897) 

00:00:32 

SWICS 

Lev 

#3 

Mod 








00:08:00 

*See note 

1 









00:32:00 

*See note 

2 


3 

00:02:08 

SWICS 

Lev 

§2 

Mod 

(895) 

02:16:32 

SWICS 

Off 



4 

00:03:44 

SWICS 

Lev 

#3 

Mod 

(893) 

04:33:04 

SWICS 

lev 

#3 

Mod 

5 

00:05:20 

SWICS 

Off 

(891 ) 


04:38:24 

SWICS 

Off 




00:08:00 

*See note 

1 








6 

00:08:32 

SWICS 

Lev 

#1 

Mod 

(897) 

04:41 : 36 

SWICS 

lev 

#3 

Mod 

7 

00:10:08 

SWICS 

Lev 

#2 

Mod 

(895) 

06:50:40 

SWICS 

Off 



8 

00:11 : 44 

SWICS 

Lev 

#3 

Mod 

(893) 

06:58:08 

SWICS 

lev 

#3 

Mod 

9 

00:13:20 

SWICS 

Off 

(891 ) 


09:10:24 

SWICS 

Off 




00:32:00 

*See note 

2 








10 

00:32:32 

SWICS 

Lev 

#1 

Mod 

(897) 

09:14:40 

SWICS 

lev 

#3 

Mod 

1 1 

00:34:08 

SWICS 

Lev 

#2 

Mod 

(895) 

09:40:16 

SWICS 

Off 



12 

00:35:44 

SWICS 

Lev 

#3 

Mod 

(893) 

09:41 : 52 

SWICS 

lev 

#3 

Mod 

13 

00:37:20 

SWICS 

Off 

(891 ) 


09:43:28 

SWICS 

Off 




Note 1 - Black Body Heaters Turned On By Pulse Discrete Command 
Note 2 - Black Body Heaters Turned Off By Pulse Discrete Command 


(b) - Solar Calibration Sequence 
Before Malfunction (Normal) After Malfunction 


Step 

No. 

Elapsed 

Time 

(H:M:S) 

Event Description 


Elapsed 

Time 

(H:M:S) 

Event Description 

1 

00:00:00 

Solar Cal Seq Cmd 

(8A2) 

00:00:00 

Sol Cal Seq Cmd 

2 

00:00:32 

Short Earth Scan 

(824) 

00:00:32 

Invalid Cmd - Hex 
cmd code 804 

3 

00:01 : 04 

Azimuth to 0 deg 

(811) 

02:16:32 

Azimuth to 0 deg 

4 

00:01 : 36 

Azimuth to Pos A 

(814) 

02:18:08 

Invalid Cmd - Hex 
cmd code 804 

5 

00:06:24 

MAM scan (825) 


04:33:04 

MAM scan 


12 


Volt* 


N0AA-10 SCANNER MAY 10. 1989 

SW1CS AMPLIFIER (SSWCSA1. SSWCSA2, SSWCSA3) 



a tt e oo 
Unlv*r»«l Tim* 


(a) - Normal sequence 


N0AA-1C SCANNER JULY 5. 1989 

SWICS AMPLIFIER (SSWCSA1, SSWCSA2. SSWCSA3) 



1000 1100 12:00 13:00 14 00 16:00 16:00 IT :00 10:00 10 00 20:00 

Unlv«r»*t Tim* 
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Failure Analysis 


The flight data gathered over the period from May 22 to July 5 
was reviewed and analyzed in a attempt to identify the failure 
mode, probable cause of the failure, and guidelines for 
restoration of instrument operation. Initial review of the data 
indicated that many instrument functions were still operating 
normally. Thus to simplify the analysis process, the assumption 
was made that the malfunction was the result of a single point 
failure. The instrument data for each response was analyzed to 
eliminate subsystems and components as potential causes of the 
malfunction. 


Observations and Analysis 
Reset Command 

The CPU Reset command causes a hardware reset of the 
microprocessor; which in turn causes all internal registers to be 
cleared and a restart of the firmware code. The ROM code 
initialization causes the RAM memory to be cleared and 
initialization of selected scanner hardware including removal of 
power from the elevation motor drive circuit. The fact that the 
processor responded to a reset instruction and normal data 
transfers were restored, indicated that the spacecraft command 
and data transfer circuitry, spacecraft 1.2M Hz clock, counter 
and interrupt circuits are functioning normally, and that the 
microprocessor, ROM, and RAM memories are functioning normally 
for at least a substantial portion of the instruction set and 
memory area. Initialization, data acquisition, and telemetry 
transfers require proper operation of substantial portions of the 
background program as well as interrupts 3 and 4, and use large 
variable blocks in the RAM memory. See memory map figure 3. 


Spacecraft DIG A Data Transfer 

Analysis of the hardware and software responsible for the 
transfer of DIG A data from the instrument microprocessor to the 
spacecraft interface indicates that the transfer of meaningful 
data from the microprocessor memory to the spacecraft interface 
is totally dependent on correct and timely execution of software 
routines by the microprocessor. In the event that the 
microprocessor fails to transmit data to the spacecraft 
instrument the interface hardware will transmit a continuous 
stream of zeros when prompted. 
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Since the DIG A data stream is restored following a reset, it is 
unlikely that there is a failure in the instrument serial data 
interface hardware or the spacecraft interface. It is far more 
likely that the microprocessor is not sending the data because of 
a failure of the microprocessor or related circuits. 


Azimuth Commands 

The normal response of the scanner instrument to all azimuth 
commands indicated that the azimuth mechanism and drive are 
functioning normally, and supports the argument for proper 
computer operation. Execution of azimuth commands require the 
proper function of the interrupt service routine for interrupt 2 
and a portion of the background program not required for 
initialization, data acquisition, or telemetry transfer. See 
memory map figure 3. 


Scan Commands 

There are 5 different scan mode commands (Normal, Nadir, Stow, 
Short, MAM), but each scan command begins with the same 
initialization sequence. 

Scanner elevation position data is derived by counting pulses 
from an incremental encoder. Following an instrument power-up, 
the elevation position counter requires the initialization 
sequence to preset the counter as the scan head passes through 
the nadir (encoder index) position. However, as long as 
instrument power is not removed the counter should maintain the 
correct position value. The initialization sequence includes 
movement of the elevation scan head at a controlled speed in 
clockwise (CW) and counter clockwise (COW) directions, and the 
acquisition of position lock at the space-look position (1000 
encoder count ) . 

The observed response to each of the scan mode commands was 
identical. For each scan mode command the scanner elevation beam 
was observed to drive nominally in both CW and CCW directions for 
the prescribed time periods. The DIG A data reverted to zeros 
before the elevation beam data indicated a position lock at space 
or the start of the requested scan sequence. The failure 
indications were similar to the initial malfunction. The DIG A 
data stream went to all zeros, but the increase in temperature 
was not observed and the DIG B data indicated that power had been 
removed from the scan motor drive. Elevation position data 
following a reset indicated that the scanner head was sitting at 
the nominal space look position (1000 counts). Analysis of 
position displacement data from subsequent initialization 
sequences also indicated that the head was actually resting at 
the nominal space-look position. This indicates that position 
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lock at space was achieved at the end of initialization, and that 
the motor power was removed prior to the scanner drive receiving 
the first velocity command in the scan command sequence, t 
velocity command was not issued, or both of these events 
occurred . 

This data is significant as the command path and the actual 
hardware commands issued to the scanner drive during 
initialization are identical to those issued at the beginning o 
each scan sequence. This rules out problems with the mechanical 
or electrical scanner drive components, command path, loading ot 
the power bus, or loss of the spacecraft clock. 

In addition it permits a possible explanation for the temperature 
rise noted following the initial malfunction and the absence of 
this temperature rise in subsequent tests This temperature rise 
phenomena has been observed and documented as part of the ERB 
Scanner Instrument Anomaly Investigation (Reference 2). The 
scanner drive has two power modes, high and low, which are 
autonomously selected on the basis of the error signal presented 
to the driver. Power dissipation in high power mode is 4 times 
higher than for low power mode. During nominal operation, hig 
power mode is activated for only a small fraction of total scan 
time. Since the initial failure occurred with the scan head in 
mid-scan and all indications are that the scanner drive was 
faithfully executing the last received velocity command, the 
scanner drive would have continued to drive the scan head at 
continuous velocity until the head impacted the mechanical stops. 
With the scanner drive executing a velocity drive command, and 
the head mechanically restrained the error signal to the motor 
drive would have saturated and forced the driver into continuous 
high power mode. This has been shown to result in temperature 
rises similar to those observed following the malfunction. In 
the subsequent tests, following CPU-Reset commands, no heating 
would be expected as the head was locked at the space-look 
position, and motor power was removed. 


SWICS Commands and Internal Calibration Sequence Command 

Individual Short Wave Internal Calibration Source (SWICS) 
commands were issued for modulated levels 1 , 2 and 3, and the 
instrument performed nominally. This verified that the 
instrument was capable of executing SWICS commands for each of 

the 3 levels. 

The internal calibration sequence command normally executes a 
series of SWICS modulated level commands from level 1 to level J 
at preset time intervals to create a profile as shown in figure 
2a. However, when the internal calibration sequence was issued 
to the NOAA-IO scanner following the malfunction, a sequence of 
SWICS level 3 and SWICS off commands were executed with a 
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radically different time sequence as shown in figure 2b. The 
total number of SWICS commands was the same as for a normal 
sequence, and following the completion of the sequence the 
scanner returned to its "standby" mode. Primary instrument data 
(DIG A) remained valid throughout and following the internal 
calibration sequence. 


Program Memory Considerations 

The fact that the only commands which produced anomalous or 
failure condition were internal sequence commands, prompted a 
review of the manner in which these commands were executed and 
their relative location in memory. The routines responsible for 
execution of these commands showed no apparent unique common code 
or instructions, but the tabular information used by both of 
these routines was determined to be the sole contents of the high 
ROM chip (A2A1-U50). 

A comparison of the internal calibration SWICS commands, and the 
erroneously executed SWICS commands, shown in table 4, suggested 
some interesting failure mechanisms. The internal calibration 
table consists of twenty-five bytes of information which define 
twelve internal instrument command events, and a sequence stop 
byte, shown in table 5. Each event is defined by an event time 
relative to the major frame counter, which is reset when the 
internal calibration command is received, and an internal SWICS 
command to be executed at the prescribed time. The stored 
commands are same as the lower byte of the instrument level 
commands. As an example, execution of the internal table hex 
value 97H causes the same SWICS function as the instrument level 
hex command 897H. Note that the command sequence Level 1 (97H), 
Level 2 (95H) , Level 3 (93H), and SWICS Off (91H) are repeated 
three times; that the Level 3 and SWICS Off commands can be 
derived from the Level 1 and Level 2 commands respectively by 
clearing a single bit (b2); and that the Level 1 and Level 2 
commands are offset from the Level 3 and SWICS Off commands 
respectively by 4 counts which can be achieved by setting a 
single address bit (b2). 

The SWICS internal calibration sequence became the Rosetta Stone 
for the remaining trouble shooting and analysis which was 
performed almost .exclusively by analysis and simulation of the 
microprocessor and high ROM program code interaction. 

To execute the internal calibration sequence the processor loads 
the first event time and first command from the table, then on 
each subsequent major frame interrupt (32 sec) it compares the 
major frame counter to the first event time, and if the event 
time matches the major frame counter it issues the first internal 
SWICS command. Once the sequence commands are issued the 
software and hardware mechanism for their execution is identical 
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Table 5 

Comparison of Calibration C omman d Tables 
Before and After Malfunction 


(a) - Internal Calibration Sequence 


Before Malfunction (Normal) 


Step 

Command 

Time 

Code 

Description 

Code 

Hex 

(Dec) 


1 




Int Cal Seq 

2 

97 

01 

(1 ) 

Lev ff 1 Mod 

3 

95 

04 

(4) 

Lev if 2 Mod 

4 

93 

07 

(7) 

Lev it 3 Mod 

5 

91 

0A 

(10) 

SWICS Off 

6 

97 

10 

(16) 

Lev if 1 Mod 

7 

95 

13 

(19) 

Lev if 2 Mod 

8 

93 

16 

(22) 

Lev #3 Mod 

9 

91 

19 

(25) 

SWICS Off 

10 

97 

3D 

(61 ) 

Lev if 1 Mod 

11 

95 

40 

(64) 

Lev if 2 Mod 

12 

93 

43 

(67) 

Lev if 3 Mod 

13 

91 

46 

(70) 

SWICS Off 


After Malfunction 


Command 

Time 

Code 

Description 

Code 

Hex 

(Dec) 

Int Cal Seq 

93 

01 

(1) 

Lev ff 3 Mod 

91 

00 

(0) 

SWICS Off 

93 

00 

(0) 

Lev if 3 Mod 

91 

0A 

(10) 

SWICS Off 

93 

10 

(16) 

Lev if 3 Mod 

91 

02 

(2) 

SWICS Off . 

93 

10 

(16) 

Lev it 3 Mod 

91 

08 

(8) 

SWICS Off 

93 

10 

(16) 

Lev ff 3 Mod 

91 

40 

(64) 

SWICS Off 

93 

43 

(67) 

Lev ff 3 Mod 

91 

46 

(70) 

SWICS Off 


(b) - Solar Calibration Sequence 


Before Malfunction (Normal) After Malfunction 


Step 

Command 

Time 

Code 

Description 

Command 

Time 

Code 

Description 

Code 

Hex 

(Dec) 


Code 

Hex 

(Dec) 


1 




Solar Cal Seq 




Sol Cal Seq 

2 

24 

01 

(1 ) 

Short Scan 

04 

01 

(1) 

Invalid Cmd 
Hex 804 

3 

11 

02 

(2) 

Azimuth to 0 

11 

00 

(0) 

Azimuth to 0 

4 

14 

03 

(3) 

Azimuth to A 

04 

03 

(3) 

Invalid Cmd 
Hex 804 

5 

25 

12 

(18) 

MAM Scan 

25 

00 

(0) 

MAM scan - 
Fail after 
init . 

6 

15 

22 

(34) 

Azimuth to B 





7 

14 

34 

(52) 

Azimuth to A 





8 

24 

44 

(68) 

Short Scan 





9 

11 

45 

(69) 

Azimuth to 0 





10 

22 

54 

(22) 

Normal Scan 





Notes 

: (1 ) 

Stored commands do not contain the high byte ,l 8 n . 

(2) 

Bold 

type 

indicates correct command or event time* 
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to that for SWICS commands issued by the spacecraft. The 
internal calibration sequence continues issuing SWICS commands at 
the prescribed intervals until it encounters the stop byte, an 
interval time of 255 (FF Hexadecimal). 

An understanding of the major frame counter is essential to 
understanding the extremely long internal calibration sequence 
intervals observed for the malfunctioning scanner instrument. 

The major frame counter is a byte wide and thus acts as a modulus 
256 counter. Thus, if the succeeding event time which the 
processor receives from the ROM data table is the same or less 
than the present major frame value the major frame counter will 
have to cycle through zero to match the counter with the event 
time. 


SWICS Internal Calibration Implementation 

Analysis of flight data from the malfunctioning scanner 
instrument indicated the number of major frame intervals which 
occurred between SWICS commands . From these intervals and the 
fact that the first command was issued on the first major frame 
the assumed event time codes shown in table 5 were derived. 


First Failure Hypothesis 

A failure in the microprocessor, address bank decoding circuits, 
address buffers, or high ROM is causing one or more address 
and/or data bits to be cleared or set when reading data and code 
from the high ROM memory. This erroneous data and code is in 
turn producing the observed system malfunction. 


First Hypothesis Testing 

The cross mapping of high memory addresses into low memory was 
rejected as a probable cause of the failure when the low memory 
data in either of the 2 low ROMs could not support the SWICS 
Level 3 and SWICS Off sequence. This eliminates the bank 
decoding circuitry as a likely cause of the malfunction. 

A computer program generated and tested thousands of combinations 
of address and/or data bits set or cleared in an attempt to match 
both the SWICS and event time sequences observed in the flight 
data. Hundreds of combinations were generated which produced the 
proper command sequence, but none of the event time sequences 
were even close to the sequence derived from the flight data. 

For this reason it is considered unlikely that a combination of 
address and data bits set or cleared is a likely cause of the 
problem. This eliminates the microprocessor and bus drives as a 
likely cause of the malfunction. 
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Further comparison of internal calibration data table commands 
and event times with the commands and event times derived from 
the flight data, indicated that there were 2 blocks of table data 
which could have been read normally. These blocks (addresses 
10D4H-10D7H & 10E4H-10E7H) are each 4 bytes long and separated 
by a span of 1 2 bytes. This address pattern suggested a revised 
failure hypothesis. 


Revised Failure Hypothesis 

A failure in the address decoding logic of the high ROM (A2 A1 - 
U50), causing a logical ANDing of multiple memory locations, 
would result in erroneous data and code being executed by the 
microprocessor. Specifically, data output from the ROM is the 
logical ANDing of the data at the specified address with the data 
at the location with the specified address modified by setting 
bit 2 and clearing bit 3 as shown in table 6. This erroneous 
data and code processed by the microprocessor in turn produces 
the observed system malfunction. 


Revised Hypothesis Testing 

An Internal Calibration Sequence data table corresponding to this 
failure hypothesis was generated. The commands and event times 
from this table were compared with commands and event times 
apparently being executed by the flight instrument. The 
agreement was perfect. 

Demonstrating the connection between the proposed ROM failure and 
scan mode command related failure required greater effort. The 
high ROM contains 2 type of "tables" which are used to produce 
the 5 scan profiles. There is a data table for each of the 5 
scan modes, which contains a sequence of event times and code 
entry pointers, which in turn define the piecewise continuous 
scan profiles. The first byte contains the event time which is 
similar to the internal calibration event times except that they 
are referenced to the 33.3 ms (120 count) interrupt driven clock. 
The next two bytes contain the address of a block of code, also 
in the high ROM, which executes a scanner drive level command 
(e.g. slew clockwise in velocity mode at 66 degrees per second). 

A complete high ROM data/code set corresponding to this failure 
hypothesis was generated, and used in a computer simulation of 
the microprocessor and associated circuits. A simulation of the 
normal scan command was performed, and the results account for 
the observed flight instrument behavior. The simulation 
indicated nominal performance through the initialization 
sequence. When the processor attempted to use data from the 
table, erroneous commands were issued including a command to 
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Table 6 

Internal Calibration Sequence Table 
Normal and Erroneous Data 


Memory Address Memory Data Mask Data Erroneous Data 


Hex 


Binary 


Hex 

Binary 

Hex 

Binary 

Hex 

Binary 

1 OCF 

0001 

0000 

1100 

1111 

01 

0000 

0001 

67 

0110 

0111 

01 

0000 

0001 

10D0 

0001 

0000 

1101 

0000 

97 

1001 

0111 

93 

1001 

001 1 

93 

1001 

0011 

10D1 

0001 

0000 

1101 

0001 

04 

0000 

0100 

0A 

0000 

1010 

00 

0000 

0000 

10D2 

0001 

0000 

1101 

0010 

95 

1001 

0101 

91 

1001 

0001 

91 

1001 

0001 

10D3 

0001 

0000 

1 1 01 

0011 

07 

0000 

0111 

10 

0001 

0000 

00 

0000 

0000 

10D4 

0001 

0000 

1101 

0100 

93 

1001 

0011 

93 

1001 

0011 

93 

1001 

0011 

10D5 

0001 

0000 

1101 

0101 

0A 

0000 

1010 

0A 

0000 

1010 

OA 

0000 

1010 

10D6 

0001 

0000 

1101 

0110 

91 

1001 

0001 

91 

1001 

0001 

91 

1001 

0001 

10D7 

0001 

0000 

1101 

01 1 1 

10 

0001 

0000 

10 

0001 

0000 

10 

0001 

0000 

10D8 

0001 

0000 

1101 

1000 

97 

1001 

0111 

93 

1001 

0011 

93 

1001 

0011 

1 0D9 

0001 

0000 

1101 

1001 

13 

0001 

0011 

0A 

0000 

1010 

02 

0000 

0010 

10DA 

0001 

0000 

1101 

1010 

95 

1001 

0101 

91 

1001 

0001 

91 

1001 

0001 

10DB 

0001 

0000 

1101 

1011 

16 

0001 

0110 

10 

0001 

0000 

10 

0001 

0000 

10DC 

0001 

0000 

1101 

1100 

93 

1001 

0011 

93 

1001 

0011 

93 

1001 

0011 

1 ODD 

0001 

0000 

1 1 01 

1 1 01 

19 

0001 

1001 

OA 

0000 

1010 

08 

0000 

1000 

1 ODE 

0001 

0000 

1 1 01 

1110 

91 

1001 

0001 

91 

1001 

0001 

91 

1001 

0001 

10DF 

0001 

0000 

1101 

1111 

3D 

0011 

1101 

10 

0001 

0000 

10 

0001 

0000 

1 0E0 

0001 

0000 

1110 

0000 

97 

1001 

0111 

93 

1001 

0011 

93 

1001 

0011 

10E1 

0001 

0000 

1110 

0001 

40 

0100 

0000 

46 

0100 

0110 

40 

0100 

0000 

10E2 

0001 

0000 

1110 

0010 

95 

1001 

0101 

91 

1001 

0001 

91 

1001 

0001 

10E3 

0001 

0000 

1110 

001 1 

43 

0100 

0011 

FF 

1111 

1111 

43 

0100 

0011 

10E4 

0001 

0000 

1110 

0100 

93 

1001 

0011 

93 

1001 

0011 

93 

1001 

0011 

10E5 

0001 

0000 

1110 

0101 

46 

0100 

0110 

46 

0100 

0110 

46 

0100 

0110 

10E6 

0001 

0000 

1110 

0110 

91 

1001 

0001 

91 

1001 

0001 

91 

1001 

0001 

10E7 

0001 

0000 

1110 

0111 

FF 

1111 

1111 

FF 

1111 

1111 

FF 

1111 

1111 


Note: Bold print indicates commands or event times which are not 

modified by the fault. 


remove power from the elevation drive motor. The processor then 
executed a command at location 1000 hex for which the erroneous 
value read from ROM was zero. 

The CDP-1802 machine instruction corresponding to the value zero 
is the IDLE instruction which is somewhat unique to the 1802 
processor family. The function of the instruction is to place 
the processor in a kind of "suspended animation" until it 
receives a hardware signal in the form of an interrupt or a 
Direct Memory Access (DMA). The DMA function is not implemented 
in the ERBE instruments, so the only means of exiting from an 
IDLE condition is via a hardware interrupt. Interrupts are 
implemented in the ERBE Scanner Instrument for 33 ms clock, the 
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major frame clock, and azimuth drive. However, the processor 
will not respond to these hardware signals if the interrupt 
enable flag is not set. 

In the fault mode simulation the processor executed the IDLE 
instruction with the interrupt enable bit cleared. Execution of 
this instruction effectively killed all microprocessor controlled 
instrument functions including the issuing of scan drive 
commands, acquisition of data, and transmission of DIG A data to 
the spacecraft interface. The only possible exit from this 
condition is a CPU-reset. 

A Solar Calibration Sequence data table corresponding to this 
failure hypothesis was generated. The commands and event times 
from this table were used to predict the behavior of the flight 
instrument. A Solar Calibration Sequence command was issued to 
the instrument on September 15, and the flight data was in 
complete agreement with the predictions. 


Conclusions and Recommendations 

The simulation results and the ability to predict the behavior of 
the instrument when issued a solar calibration sequence strongly 
support the conclusion that the cause of the NOAA-IO ERBE Scanner 
malfunction is traceable to a failure of the internal address 
decoding circuitry of the high ROM memory chip A2 A1-LI50. The 
failure causes a logical ANDing of multiple memory locations, and 
the resulting erroneous code and/or data. When the erroneous 
data and/or code is executed by a normally functioning 
microprocessor, it produces the anomalous behavior and 
malfunctions which have been observed in the flight instrument. 


Since there is no method of reprogramming the processor, and 
there are no alternate scan modes which are functional, the only 
course of action which remained was to power-down and then power- 
up the instrument on the chance that the failure in the ROM would 
be self healing. The probability of this being successful was 
low as the ROM memory chip (generic part S82S191) is a bipolar 
fusible link device. When this was tried on October 17 and 
failed to produce any change in instrument performance, no 
further tests were recommended. 


There are some similarities between failure of the ERBE Scanner 
instruments on NOAA-9 and NOAA-IO. However, since the scanner on 
NOAA-9 would not respond to a CPU-Reset attributing the failure 
to a memory failure would be speculative at best. 
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Although the cause of the failure can not be determined from 
available data, some comments can be made about the suspect part. 
The 21002BJX ROM devices (generic part S82S191) is on the MIL- 
38510 parts list and has been used extensively in military and 
spaceflight hardware, including a total of eighteen devices 
installed on the 6 ERBE Scanner and Nonscanner Instruments . 
Records indicate that no failures have been recorded in 
commercial, military or space use of the part due to 
manufacturing defects. Some ionizing radiation testing has 
shown, however, that this part is susceptible to single event 
upset (SEU). Charge build-up within the device due to gamma ray 
or high energy ion bombardment could cause bit latch-up and 
failure. The excess parts lists from ERBE instrument fabrication 
have been reviewed, and it has been determined that there are no 
remaining ROM chips from the flight lot on which further tests 
could be performed. 

It is strongly recommended that Langley Research Center require 
the CERES instruments and any other extended mission instrument 
to be built with the capability of reprogramming the instrument 
in flight. Since a ROM failure in the bootstrap program is just 
as likely as in any other portion of code, it is further 
recommended that instrument designs have redundant bootstrap 
ROMs, direct RAM access from the spacecraft data bus, or 
redundant processors . 
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